Migrate pull request automation away from pull_request_target (#2625)

Browse Source

* Migrate pull_request_target workflows

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Address PR duplicate check writer review

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Fix duplicate-check writer artifact handling

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Make PR duplicate check gh-aw compilable

Configure the agentic workflow source to allow fork PR triggers with staged safe outputs, upload a PR context artifact through supported post-steps, and have the workflow_run writer consume that context before publishing validated comments. This lets gh-aw regenerate the lockfile without restoring pull_request_target or privileged PR-code execution.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 512eb347-ec89-4250-8bf1-87048974b01d

* Harden workflow-run PR writers

Bind privileged artifact processing to trusted workflow-run PR identity, serialize same-PR writers, and cap aggregate quality comments.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 512eb347-ec89-4250-8bf1-87048974b01d

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 512eb347-ec89-4250-8bf1-87048974b01d

...

This commit is contained in:

Michael Recachinas

2026-08-13 21:22:06 -04:00

committed by GitHub

parent db17698618

commit 925dc83735

9 changed files with 1474 additions and 430 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

.github/workflows/pr-duplicate-check.lock.yml

Generated

+93 -75

File diff suppressed because one or more lines are too long